PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
dbg_help_wrapper.h
Go to the documentation of this file.
1#pragma once
2
3#include <windows.h>
4#include <dbghelp.h>
5#pragma comment(lib, "dbghelp.lib")
6
7#include <iostream>
8#include <mutex>
9#include <unordered_map>
10#include <string>
11
13{
14public:
15
16 static bool InitializeProcess(HANDLE hProcess, const std::string& symbolPath, DWORD symOptions)
17 {
18 std::lock_guard<std::mutex> guard(m_Mutex);
19
20 SessionInfo& session = sessions[hProcess];
21
22 if (session.refCount > 0) {
23 ++session.refCount;
24 return true;
25 }
26
27 SymSetOptions(symOptions);
28
29 if (!SymInitialize(hProcess, symbolPath.empty() ? nullptr : symbolPath.c_str(), FALSE)) {
30 session.lastError = GetLastError();
31 return false;
32 }
33
34 if (!symbolPath.empty()) {
35 SymSetSearchPath(hProcess, symbolPath.c_str());
36 }
37
38 session.initialized = true;
39 session.refCount = 1;
40 session.lastError = ERROR_SUCCESS;
41 return true;
42 }
43
44 static bool CleanupProcess(HANDLE hProcess)
45 {
46 std::lock_guard<std::mutex> guard(m_Mutex);
47
48 std::unordered_map<HANDLE, SessionInfo>::iterator it = sessions.find(hProcess);
49
50 if (it == sessions.end()) {
51 return true;
52 }
53
54 SessionInfo& session = it->second;
55
56 if (session.refCount > 1) {
57 --session.refCount;
58 return true;
59 }
60
61 if (session.initialized) {
62 if (!SymCleanup(hProcess)) {
63 session.lastError = GetLastError();
64 return false;
65 }
66 }
67 sessions.erase(it);
68 return true;
69 }
70
71 static bool RefreshModuleList(HANDLE hProcess)
72 {
73 std::lock_guard<std::mutex> guard(m_Mutex);
74
75 if (!SymRefreshModuleList(hProcess)) {
76 return false;
77 }
78 return true;
79 }
80
81 static bool RunStackWalk64(
82 _In_ DWORD MachineType,
83 _In_ HANDLE hProcess,
84 _In_ HANDLE hThread,
85 _Inout_ LPSTACKFRAME64 StackFrame,
86 _Inout_ PVOID ContextRecord,
87 _In_opt_ PREAD_PROCESS_MEMORY_ROUTINE64 ReadMemoryRoutine,
88 _In_opt_ PFUNCTION_TABLE_ACCESS_ROUTINE64 FunctionTableAccessRoutine,
89 _In_opt_ PGET_MODULE_BASE_ROUTINE64 GetModuleBaseRoutine,
90 _In_opt_ PTRANSLATE_ADDRESS_ROUTINE64 TranslateAddress
91 )
92 {
93 std::lock_guard<std::mutex> guard(m_Mutex);
94 if (StackWalk64(MachineType, hProcess, hThread, StackFrame, ContextRecord, ReadMemoryRoutine, FunctionTableAccessRoutine, GetModuleBaseRoutine, TranslateAddress)) {
95 return true;
96 }
97 return false;
98 }
99
100 static bool FromAddress(HANDLE hProcess, DWORD64 address, PSYMBOL_INFO symbol, DWORD64* displacement)
101 {
102 std::lock_guard<std::mutex> guard(m_Mutex);
103 if (!SymFromAddr(hProcess, address, displacement, symbol)) {
104 return false;
105 }
106 return true;
107 }
108
109 static bool GetModuleInfo(HANDLE hProcess, DWORD64 address, IMAGEHLP_MODULE64* moduleInfo)
110 {
111 std::lock_guard<std::mutex> guard(m_Mutex);
112
113 moduleInfo->SizeOfStruct = sizeof(IMAGEHLP_MODULE64);
114 if (!SymGetModuleInfo64(hProcess, address, moduleInfo)) {
115 return false;
116 }
117 return true;
118 }
119
120 static DWORD GetLastErrorForProcess(HANDLE hProcess)
121 {
122 std::lock_guard<std::mutex> guard(m_Mutex);
123
124 auto it = sessions.find(hProcess);
125 if (it == sessions.end()) {
126 return ERROR_INVALID_HANDLE;
127 }
128 return it->second.lastError;
129 }
130
131private:
132
133 struct SessionInfo
134 {
135 bool initialized;
136 size_t refCount;
137 DWORD lastError;
138
139 SessionInfo()
140 : initialized(false),
141 refCount(0),
142 lastError(ERROR_SUCCESS)
143 {
144 }
145 };
146
147 static std::mutex m_Mutex;
148 static std::unordered_map< HANDLE, SessionInfo> sessions;
149};
static bool FromAddress(HANDLE hProcess, DWORD64 address, PSYMBOL_INFO symbol, DWORD64 *displacement)
static bool CleanupProcess(HANDLE hProcess)
static bool GetModuleInfo(HANDLE hProcess, DWORD64 address, IMAGEHLP_MODULE64 *moduleInfo)
static bool RefreshModuleList(HANDLE hProcess)
static DWORD GetLastErrorForProcess(HANDLE hProcess)
static bool InitializeProcess(HANDLE hProcess, const std::string &symbolPath, DWORD symOptions)
static bool RunStackWalk64(_In_ DWORD MachineType, _In_ HANDLE hProcess, _In_ HANDLE hThread, _Inout_ LPSTACKFRAME64 StackFrame, _Inout_ PVOID ContextRecord, _In_opt_ PREAD_PROCESS_MEMORY_ROUTINE64 ReadMemoryRoutine, _In_opt_ PFUNCTION_TABLE_ACCESS_ROUTINE64 FunctionTableAccessRoutine, _In_opt_ PGET_MODULE_BASE_ROUTINE64 GetModuleBaseRoutine, _In_opt_ PTRANSLATE_ADDRESS_ROUTINE64 TranslateAddress)